@patrickdk77/pdf-defuse 0.2.0 → 0.2.2

package/README.md

@@ -69,7 +69,7 @@ Removed by default:
 - Actions that reach outside the document: launching programs, links to other or embedded files, form submit and import, show and hide toggles, layer toggles, menu commands and media.
 - Links other than http, https and mailto, and links built to mislead. That covers credentials before the host, IP hosts, punycode or mixed-script hosts, encoded hosts, tooltips or alternate text that name a different site, links and push buttons that cover most of a page, and relative links with no base address.
 - Attached files, portfolios, XFA forms, slideshows, media and 3D annotations, and annotation types outside an allowlist.
-- Encryption with an empty password, or with the password you pass.
+- Encryption with an empty password, or with a password you pass.
 - Earlier revisions, unreferenced objects and damaged structure. The output is one clean revision, unless it is a signed file that keeps its bytes, as described below.
 
 Kept: text, images, fonts, layout, bookmarks, form fields and their values, safe links and metadata.
@@ -121,7 +121,7 @@ A run that stops before it has seen the whole file rejects the file with a null
 
 | Option | Default | Purpose |
 |---|---|---|
-| `password` | `''` | Tried as the user password, then as the owner password, then as the empty password. See Passwords below |
+| `password` | `''` | One password or a list. pdf-defuse tries each in order, as the user password and then as the owner password, and the empty password last. See Passwords below |
 | `limits` | none | `fileSize`, `objects`, `decompressedBytes`, `nestingDepth` and `timeMs`. A limit left out is not enforced |
 | `stripMetadata` | `false` | Remove the document information dictionary wherever it is referenced, and the XMP metadata of every object: the catalog, pages, images and the rest |
 | `actionOverrides` | none | Change the action for a category, or for a category and detail |
@@ -139,11 +139,13 @@ await disarmPdf(bytes, { actionOverrides: [{ category: 'JAVASCRIPT', action: 're
 
 ### Passwords
 
+`password` takes one password or a list, because one upload can hold files with different passwords, such as a ZIP with one password and a PDF inside it with another. pdf-defuse tries each entry in order, as the user password and then as the owner password, and stops at the first that opens the file. The empty password comes after the list, so a file that opens without a password opens whatever the list holds. ENCRYPTED/USER_PASSWORD or ENCRYPTED/OWNER_PASSWORD says which kind of password opened the file. `pdfPlugin()` gives every attached PDF the list of the run that found it, and `pdfPlugin(options)` gives it the list in `options`.
+
 A revision 6 password, the AES-256 scheme of ISO 32000-2, is tried three ways: prepared with SASLprep, as that standard requires, prepared the way pdf.js prepares it, and as typed. The last opens files from tools that skip SASLprep. Other revisions use the password as typed.
 
 An empty owner password opens a file, as in qpdf, and ENCRYPTED/OWNER_PASSWORD reports it. pdf.js asks for a password there.
 
-A file that encrypts only its attached files, through a crypt filter with `/AuthEvent /EFOpen`, opens without the password, as in pdf.js, and ENCRYPTED/ATTACHMENTS_ONLY reports it. pdf-defuse removes the attached files the password does not decrypt and any other stream under their key, which ENCRYPTED/NO_KEY reports. pdf.js draws such a page blank.
+A file that encrypts only its attached files, through a crypt filter with `/AuthEvent /EFOpen`, opens without a password, as in pdf.js, and ENCRYPTED/ATTACHMENTS_ONLY reports it. pdf-defuse removes the attached files that no password you pass decrypts, and any other stream under their key, which ENCRYPTED/NO_KEY reports. pdf.js draws such a page blank.
 
 ## Plugins
 
@@ -268,7 +270,7 @@ The `fileSize`, `objects` and `decompressedBytes` limits apply to one file and h
 pdf-defuse inspect <file> [options]
 pdf-defuse defuse <in> <out> [options]
 
---password-file <path>   read the password from a file, or set PDF_DEFUSE_PASSWORD
+--password-file <path>   read passwords from a file, one per line; PDF_DEFUSE_PASSWORD holds one
 --plugin <module>        load plugins from a file or an installed package, repeatable
 --config <module>        load a whole options object, repeatable; the other options apply on top
 --keep-type <type>       keep attached files of this MIME type or file extension unchanged, repeatable
@@ -286,6 +288,8 @@ Use `-` for stdin or stdout. The tool copies stdin to a temporary file in `tempD
 
 The text report shows each control character as an escape such as `\u001b`. The JSON report escapes DEL and the C1 range too, which JSON itself does not require. A field name or a title from the PDF can hold an escape sequence that rewrites what the terminal shows, the verdict included.
 
+`--password-file` reads one password per line. The tool drops a carriage return at the end of a line and skips blank lines, since the empty password is always tried. Spaces belong to the password. `PDF_DEFUSE_PASSWORD` holds one password, and a line break in it is part of that password. `--password-file` replaces it, and either one replaces a `password` that a `--config` module sets.
+
 `objects`, `nestingDepth` and `timeMs` take whole numbers. `fileSize` and `decompressedBytes` take sizes. Any other value is a usage error.
 
 A `--plugin` module exports `plugins`, an array, or `plugin`, a single plugin. Either can also sit on the default export, and a default export that is itself a plugin or an array of them works too. ES modules, CommonJS files and installed packages all load. Package names resolve from the working directory, and a package that exports only an `import` condition loads as well, through a subpath pattern such as `"./*"` too. `--plugin keep.js` loads `./keep.js` when the working directory has that file, and the installed package `keep.js` when it does not.

package/dist/cli.js

@@ -50,7 +50,7 @@ const USAGE = `Usage:
   pdf-defuse defuse <in> <out> [options]
 
 Options:
-  --password-file <path>   read the password from a file, or set PDF_DEFUSE_PASSWORD
+  --password-file <path>   read passwords from a file, one per line; PDF_DEFUSE_PASSWORD holds one
   --plugin <module>        load plugins from a file or an installed package, repeatable
   --config <module>        load a whole options object, repeatable; the other options apply on top
   --keep-type <type>       keep contained files of this MIME type or file extension unchanged, repeatable
@@ -181,7 +181,11 @@ async function parse(argv) {
         };
         switch (a) {
             case '--password-file':
-                password = (await fsp.readFile(next(), 'utf8')).replace(/\r?\n$/, '');
+                // The empty password is always tried, so a blank line adds nothing.
+                password = (await fsp.readFile(next(), 'utf8'))
+                    .split('\n')
+                    .map(line => line.replace(/\r$/, ''))
+                    .filter(line => line !== '');
                 break;
             case '--plugin':
                 ordered.push(...pluginsFrom(await loadModule(next())));

package/dist/document.d.ts

@@ -61,7 +61,7 @@ interface DocumentIssues {
     memoryFallback: string[];
 }
 interface OpenOptions {
-    password?: string;
+    password?: string | readonly string[];
     decompressedBytes?: number;
     objectLimit?: number;
     deadline?: number;

package/dist/document.js

@@ -681,11 +681,16 @@ class PdfDocument {
             this.encryptRefs.add(num);
         const id = this.trailer.get('ID');
         const id0 = Array.isArray(id) && id[0] instanceof objects_1.PdfString ? id[0].bytes : new Uint8Array(0);
-        const password = this.opts.password ?? '';
-        let r = crypto_1.SecurityHandler.open(dict, id0, password);
-        // A password meant for other files must not lock out one that opens without a password.
-        if (r.status === 'password-required' && password !== '')
-            r = crypto_1.SecurityHandler.open(dict, id0, '');
+        const given = this.opts.password ?? '';
+        // A password meant for other files must not lock out one that opens without a password, so the empty one comes last.
+        const passwords = new Set([...(typeof given === 'string' ? [given] : given), '']);
+        let r = { status: 'password-required' };
+        for (const password of passwords) {
+            this.checkTime();
+            r = crypto_1.SecurityHandler.open(dict, id0, password);
+            if (r.status !== 'password-required')
+                break;
+        }
         this.securityResult = r;
         if (r.status === 'ok')
             this.security = r.handler;

package/dist/objects.js

@@ -169,10 +169,5 @@ function encodeTextString(text) {
     // biome-ignore lint/suspicious/noControlCharactersInRegex: the range PDFDocEncoding keeps as is starts with control codes.
     if (/^[\x00-\x17\x20-\x7e]*$/.test(text))
         return Buffer.from(text, 'latin1');
-    const out = Buffer.alloc(2 + text.length * 2);
-    out[0] = 0xfe;
-    out[1] = 0xff;
-    for (let i = 0; i < text.length; i++)
-        out.writeUInt16BE(text.charCodeAt(i), 2 + i * 2);
-    return out;
+    return Buffer.concat([Buffer.from([0xfe, 0xff]), Buffer.from(text, 'utf16le').swap16()]);
 }

package/dist/sniff.js

@@ -95,7 +95,14 @@ function family(mime) {
  * of "page.html." is html.
  */
 function extensionOf(name) {
-    return /\.([^./\\]+)$/.exec((name ?? '').replace(/[. ]+$/, ''))?.[1].toLowerCase();
+    // A loop and lastIndexOf, since /[. ]+$/ backtracks: a name of 40,000 dots took seconds to match.
+    const n = name ?? '';
+    let end = n.length;
+    while (end > 0 && (n[end - 1] === '.' || n[end - 1] === ' '))
+        end--;
+    const dot = n.lastIndexOf('.', end - 1);
+    const ext = dot < 0 ? '' : n.slice(dot + 1, end);
+    return ext && !/[/\\]/.test(ext) ? ext.toLowerCase() : undefined;
 }
 function typeFromName(name) {
     const ext = extensionOf(name);

package/dist/types.d.ts

@@ -269,8 +269,11 @@ export interface PdfScoreBands {
     critical: number;
 }
 export interface PdfOptions {
-    /** Default '', tried as the user password and then as the owner password. */
-    password?: string;
+    /**
+     * Default ''. Each password is tried in order, as the user password and then as the owner password. The empty
+     * password comes after them, so a file that opens without a password opens whatever the list holds.
+     */
+    password?: string | string[];
     /** A limit left out is not enforced. */
     limits?: PdfLimits;
     /** Default false. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patrickdk77/pdf-defuse",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Sanitize and clean PDF files. Detects and removes JavaScript, attached files, launch actions, unsafe links and empty-password encryption, scores the risk, and writes a disarmed copy with bounded memory and no runtime dependencies.",
   "license": "MIT",
   "author": "patrickdk77",